Privacy Policy

1. Who We Are

Orcas Informatica Ltd (“Orca”, “we”, “us”, “our”) provides a cloud-based logistics and transportation compliance platform to businesses in the transport and logistics sector. This platform includes a driver licence checking function that allows our client companies to verify the driving entitlement of their own drivers.

This privacy policy explains how we collect, use, store, and protect personal data in connection with the platform, and sets out the rights of the individuals whose data we process. Orca is the data controller for the personal data described in this policy.

2. The Personal Data We Collect

2.1 Client account and user data

When a business uses our platform, we collect information needed to provide and administer the service, such as the names, job roles, work email addresses, and login credentials of the client’s authorised users.

2.2 Driver data

Where a client company uses the driver licence checking function, we process personal data relating to that company’s drivers. This may include:

• Driver name, date of birth, and address.
• Driving licence number.
• Driving licence information obtained from the DVLA under the Access to Driver Data (ADD) service — including driving entitlements and categories, any endorsements or disqualifications, and, where applicable, Certificate of Professional Competence (CPC) and digital tachograph card details.
• The driver’s signed fair processing (data protection) declaration and associated consent record.

3. How and Why We Use Personal Data

We use personal data for the following purposes:

• To provide the compliance platform to our client companies and administer their accounts.
• To enable client companies to verify their drivers’ entitlement to drive, including endorsements and validity, at the point a driver joins and at periodic intervals thereafter.
• To maintain records of driver consent and check results as required by the ADD contract.
• To meet our legal and regulatory obligations.
• To secure, maintain, and improve the platform.

4. Lawful Basis for Processing

We rely on the following lawful bases under the UK GDPR:

• Performance of a contract — to provide the platform to our client companies.
• Legitimate interests — to operate and secure the service, where these interests are not overridden by individuals’ rights.
• Legal obligation — where we are required to process or retain data to comply with the law or the ADD contract.

Driver licence checks are carried out on the basis of a signed fair processing declaration provided by the driver, in line with DVLA ADD requirements, confirming they understand how their driving licence information will be processed.

5. Who We Share Data With

We share personal data only where necessary and in accordance with the law:

• With the DVLA, in order to request driving licence information under the ADD service.
• With the relevant client company (the driver’s employer), which receives the entitlement check results for its own drivers.
• With our hosting and infrastructure provider, which stores data securely on our behalf within the United Kingdom.
• With regulators, law enforcement, or other authorities where we are legally required to do so.

6. International Transfers

All personal data processed through the platform is stored and accessed within the United Kingdom. We do not transfer this data to, or make it accessible from, any country outside the United Kingdom.

7. How Long We Keep Data

We keep personal data only for as long as necessary for the purposes described in this policy, and in line with the ADD contract:

• Driver fair processing declarations are retained for two years for audit purposes.
• A signed declaration remains valid for a maximum of three years, or until the driver ceases to drive in connection with the client company, whichever is sooner.
• Other personal data is retained for as long as the client relationship requires, and securely deleted when no longer needed.

8. How We Protect Data

We maintain appropriate technical and organisational measures to keep personal data secure. These include encryption of data in transit, access restricted to authorised personnel with unique individual logins on a least-privilege basis, up-to-date malware protection, secure UK-based hosting, and a documented information security policy. Further detail is available on request.

9. Your Rights

Individuals have rights under the UK GDPR in relation to their personal data, including the right to:

• Be informed about how their data is used.
• Access the personal data we hold about them.
• Request correction of inaccurate data.
• Request erasure of their data in certain circumstances.
• Restrict or object to processing in certain circumstances.
• Data portability, where applicable.

Where a driver’s connection with a client company ends, they have the right for their data no longer to be requested or processed in connection with that company. To exercise any of these rights, please contact us using the details below.

10. Contact and Complaints

For any questions about this policy or to exercise your data protection rights, please contact:

If you are not satisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, or by calling 0303 123 1113.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be published on our website, and the “last updated” date above will be revised accordingly.